Latest Fortinet FortiSandbox vulnerability: CVE-2026-26083 #
Fortinet disclosed in an advisory that a critical vulnerability was identified in versions of FortiSandbox.
- CVE-2026-26083: A missing authorization vulnerability exists in multiple Fortinet FortiSandbox products due to improper access control enforcement. A remote, unauthenticated attacker could exploit this vulnerability by sending crafted HTTP requests, potentially allowing the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-26083 and has been rated critical with a CVSS score of 9.1.
The following versions are affected:
- FortiSandbox 5.0: Versions 5.0.0 through 5.0.1
- FortiSandbox 4.4: Versions 4.4.0 through 4.4.8
- FortiSandbox Cloud 24: All versions
- FortiSandbox Cloud 23: All versions
- FortiSandbox Cloud 5.0: 5.0.2 through 5.0.5
- FortiSandbox PaaS 23.4: 23.4 all versions
- FortiSandbox PaaS 23.3: 23.3 all versions
- FortiSandbox PaaS 23.1: 23.1 all versions
- FortiSandbox PaaS 22.2: 22.2 all versions
- FortiSandbox PaaS 22.1: 22.1 all versions
- FortiSandbox PaaS 21.4: 21.4 all versions
- FortiSandbox PaaS 21.3: 21.3 all versions
- FortiSandbox PaaS 5.0: 5.0.0 through 5.0.1
- FortiSandbox PaaS 4.4: 4.4.5 through 4.4.8
What is Fortinet FortiSandbox? #
Fortinet FortiSandbox is a security appliance that identifies unknown threats by executing suspicious files in isolated virtual environments to monitor their behavior and then automates a response by sharing that intelligence across the network to block the detected threat.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.
Are updates or workarounds available? #
Users are encouraged upgrade affected systems to the following versions:
- FortiSandbox 5.0: Upgrade to 5.0.2 or later
- FortiSandbox 4.4: Upgrade to 4.4.9 or later
- FortiSandbox PaaS 5.0: Upgrade to 5.0.2 or later
- FortiSandbox PaaS 4.4: Upgrade to 4.4.9 or later
- FortiSandbox PaaS: Migrate to a fixed release
- FortiSandbox Cloud: Migrate to a fixed release
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
os:="Fortinet FortiSandbox%"April 2026 Fortinet FortiSandbox vulnerabilities: CVE-2026-39808, and CVE-2026-39813 #
Fortinet disclosed in two advisories that multiple vulnerabilities have been identified in versions of FortiSandbox.
- CVE-2026-39808: An OS command injection vulnerability exists within an API endpoint due to the improper neutralization of special elements. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted HTTP requests, potentially allowing for the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-39808 and has been rated critical with a CVSS score of 9.1.
- CVE-2026-39813: An API privilege escalation vulnerability exists due to a path traversal flaw. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted HTTP requests to the JRPC API. Successful exploitation may allow an attacker to bypass authentication and escalate privileges on the system. This vulnerability has been designated CVE-2026-39813 and has been rated critical with a CVSS score of 9.1.
The following versions are affected:
- FortiSandbox 4.4: Versions 4.4.0 through 4.4.8 (affected by both CVEs)
- FortiSandbox 5.0: Versions 5.0.0 through 5.0.5 (affected by CVE-2026-39813 only)
What is Fortinet FortiSandbox? #
Fortinet FortiSandbox is a security appliance that identifies unknown threats by executing suspicious files in isolated virtual environments to monitor their behavior and then automates a response by sharing that intelligence across the network to block the detected threat.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.
Are updates or workarounds available? #
Users are encouraged upgrade affected systems to the following versions:
- FortiSandbox 4.4: Upgrade to 4.4.9 or later
- FortiSandbox 5.0: Upgrade to 5.0.6 or later
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
os:="Fortinet FortiSandbox%"
